Set Up Pre-commit Hooks

[berffdnlr]

Set up pre-commit hooks for the repository to automatically run code quality, security, API contract, Dockerfile, and YAML checks before each commit.

Acceptance Criteria

• .pre-commit-config.yaml is created at the repository root.
• Pre-commit framework can be installed with pip install pre-commit.
• Pre-commit hooks can be installed with pre-commit install.
• All configured hooks can be executed with pre-commit run -a.
• OpenAPI specification validation is configured for api/openapi.yaml.
• Python formatting check is configured with Black.
• Python linting is configured with Flake8.
• Python type checking is configured with Mypy.
• Python security scanning is configured with Bandit.
• Secret/private key detection is configured.
• Dockerfile linting is configured.
• YAML validation is configured.
• Large file detection is configured.
• Documentation is added explaining how developers install and run the hooks.

Tasks

• Create .pre-commit-config.yaml in the repository root.
• Add OpenAPI linting hook for api/openapi.yaml.
• Add Black hook for Python formatting.
• Add Flake8 hook for Python linting.
• Add Mypy hook for type checking.
• Add Bandit hook for Python security scanning.
• Add secret/private key detection hook.
• Add Dockerfile linting hook.
• Add YAML validation hook.
• Add large file detection hook.
• Add short setup instructions to the README or developer documentation.
• Run pre-commit run -a and fix issues if needed.

The commit should be blocked if:

• The OpenAPI specification is invalid.
• Python code is not formatted correctly.
• Python linting fails.
• Type errors are detected.
• Security issues are found.
• Private keys or secrets are detected.
• Dockerfile syntax or best practice checks fail.
• YAML files are invalid.
• Added files are too large.

The commit should only continue if all checks pass.

Verification

• pip install pre-commit succeeds.
• pre-commit install succeeds.
• pre-commit run -a executes all configured hooks.
• Invalid YAML is rejected by the YAML hook.
• Invalid OpenAPI syntax is rejected by the OpenAPI hook.
• Python formatting issues are detected by Black.
• Python linting issues are detected by Flake8.
• Security issues are detected by Bandit.
• Private keys are detected by the secret scanning hook.
• Large files above the configured limit are rejected.